[link] Dell open sources DCEPT, a honeypot tool

Got a hanker'n for some network security and administrator fun? Dell just dropped out a honey pot to use.

Quote

The tool is called DCEPT (Domain Controller Enticing Password Tripwire). It consists of:

The DCEPT Generation Server, which creates unique honeytoken credentials for Active Directory (AD), the Windows component used by network administrators to manage accounts, processes, and permissions on devices within their domain.

The DCEPT Agent, which introduces them daily into the memory of each endpoint on the network.

The DCEPT Sniffer, which looks for Kerberos pre-authentication packets destined for the AD domain controller that match the honeytoken username. If it detects one, it alerts the network administrator and points towards the compromised workstation.